Enforce all plugin uploads to Gradle Plugin Portal require PGP signature

### Expected Behavior

Published plugins should have cryptographic signatures, so they can be verified at the consumer side.

Note: this is related to https://github.com/gradle/gradle/issues/10443, however gradle/gradle#10443 is a Gradle part for verification of checksums/signatures, however Gradle Plugin Portal forbids publishing of PGP signatures.

So this issue is to enforce (or "strongly advice") plugin authors to publish PGP signatures along with regular plugin jars.

### Current Behavior

Current plugins are published without clear signatures, so consumers cannot tell if the jar was produced by a trusted party or not.

Note: SHA signatures do not help with that.
In other words, every time a plugin updates, it would require consumers to lookup a new SHA and bake that in a build script.

If published plugins had signatures, then build script could reference "a set of trusted PGP keys", so it won't require to update the SHA sums on each version update.

### Context

I'm trying to implement a reproducible and trusted build (e.g. for https://github.com/apache/jmeter ).

The sad thing is Plugin Portal does not require plugin authors to publish signatures, so it really hard to check if a specific plugin jar is trusted or not.

For instance: https://plugins.gradle.org/m2/org/gradle/kotlin/plugins/1.2.9/
Is there a way to verify if plugins-1.2.9.jar corresponds to plugins-1.2.9-sources.jar?
Who was the author of those artifacts?